Is it safe to paste my real 2FA secret here?
Nothing is sent, stored, or logged, and you can verify that in the Network tab. Still, a real seed belongs in your authenticator app; use a test secret here, and rotate a real one if you have any doubt.
TOTP Code Generator
Your secret never leaves this page.
Paste a base32 secret or an otpauth://totp/ URI and watch the codes change every period. Built for testing 2FA integrations, and verified in your browser against the published RFC 6238 test vectors.
Loading the toolbox.
About 2otp
How Can You Verify That Nothing Leaves This Browser?
You do not have to take our word that your secret stays here. Developer tools show every request a page makes, so you can watch this page work and confirm that nothing is sent. The check takes under a minute.
- Open your browser developer tools with
F12, orCmd+Option+Ion a Mac, and select the Network tab. - Reload the page and let it finish. You will see the page's own files, its web fonts, and one anonymous page-view request. Nothing has been typed yet, so none of them can contain your secret.
- Click the clear icon in the Network tab so that the log is empty.
- Paste a test secret, reveal it, copy a code.
- Look at the Network tab again. It is still empty. For extra proof, turn on offline mode after the page loads and the tool keeps working.
Only two things can add a line to that log, and neither carries your secret. Submitting the feedback form sends the vote and comment you typed. Typing characters in a script the page has not displayed yet, such as Cyrillic or Greek, can make the browser fetch the matching font file, and that request names only the font.
The production site also sends a Content-Security-Policy header that tells your browser to refuse connections to anywhere except this site and the anonymous analytics endpoint, so a coding mistake could not quietly send your secret elsewhere.
How Does TOTP Work?
TOTP, the time-based one-time password algorithm in RFC 6238, is what authenticator apps run. Your device and the server share a secret. Every period, usually 30 seconds, both compute the number of periods since 1970, run HMAC over that counter with the secret, take four bytes from a position chosen by the last byte of the result, and keep the last six or eight digits. Because both sides use the same secret and clock, they get the same code without talking to each other.
The secret is usually shared as base32 text or inside an otpauth:// URI encoded in a QR code. The URI can also set the algorithm, the number of digits, and the period.
How Does 2otp Protect Your Secret?
A TOTP seed is a second factor: anyone who has it can produce your codes. So 2otp follows strict rules:
- It sends no analytics events of any kind. The original version sent an event on every keystroke in the secret field.
- The field is masked with a reveal toggle, and autocomplete, spellcheck, and password-manager capture are off.
- The secret lives only in this tab's memory. It is never written to storage, cookies, or the address bar.
- It is wiped when you leave the tab, switch tools, or are idle for three minutes, and it cannot come back through the Back button.
- A red notice invites you to verify all of this in the Network tab, and a second notice recommends a test secret.
What Was Fixed in the Code?
The original tool always used SHA-1, even when a URI asked for SHA-256 or SHA-512, so it showed wrong codes for those accounts. It also treated otpauth://hotp/ links as TOTP, and silently dropped mistyped characters such as 0, 1, and 8 from secrets, producing a wrong code without warning.
Now the algorithm is honored, HOTP links are refused with a clear message, and invalid base32 is reported. On every load, the page computes all eighteen RFC 6238 test vectors, six times for each of SHA-1, SHA-256, and SHA-512, and shows whether this browser gets them right.
Why Might Codes Not Match?
- Clock drift: TOTP depends on time. Sync your device clock; servers usually accept one period either side.
- Wrong algorithm, digits, or period: check the parsed values against what the issuer expects.
- A typo in a hand-copied secret: base32 uses A to Z and 2 to 7 only, so a 0 or 1 is always a mistake.
- The account uses HOTP, which counts logins instead of time.
What Other Tools Are in the Encode / Crypto Lane?
- 2hash: MD5, SHA-1, SHA-256, SHA-384, and SHA-512 of text or a file, plus HMAC and a checksum verifier.
- 2base: Binary, octal, decimal, hex, and any base to 36, with a clickable bit grid and two's complement.
Elsewhere in the toolbox: 2uuid, 2gitignore, 2csp, 2htaccess, and more on the 2toolbox home page. Part of the 2suite.io privacy-first ecosystem.
Frequently Asked Questions
Why are HOTP links rejected?
HOTP codes depend on a counter that only the issuer and your app know. Guessing it would show misleading codes, so 2otp refuses rather than guesses.
Which algorithms are supported?
The three RFC 6238 defines: SHA-1, SHA-256, and SHA-512, with 6, 7, or 8 digits and any period from 1 to 300 seconds.
What does the self-test check?
It computes the eighteen published RFC 6238 test codes in your browser and compares them with the expected values.